Skip to content

fix(ci): registry login for chart attestation; tolerate gha cache export errors #1300

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mitasovr merged 1 commit into from
Jun 11, 2026
Merged

fix(ci): registry login for chart attestation; tolerate gha cache export errors #1300

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 15 additions & 5 deletions .github/workflows/build-images.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ jobs:
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
cache-to: type=gha,mode=max,ignore-error=true
# Keyless SLSA provenance: attests "this digest was built by THIS
# workflow at THIS commit" via the runner's short-lived OIDC identity —
# no stored signing keys. push-to-registry stores the attestation next
Expand Down Expand Up @@ -258,7 +258,7 @@ jobs:
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
cache-to: type=gha,mode=max,ignore-error=true
# Keyless SLSA provenance — see backend-api-gateway for the contract.
- name: Attest build provenance
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
Expand Down Expand Up @@ -301,7 +301,7 @@ jobs:
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
cache-to: type=gha,mode=max,ignore-error=true
# Keyless SLSA provenance — see backend-api-gateway for the contract.
- name: Attest build provenance
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
Expand Down Expand Up @@ -357,7 +357,7 @@ jobs:
push: false
tags: insight-toolbox:ci-validate
cache-from: type=gha
cache-to: type=gha,mode=max
cache-to: type=gha,mode=max,ignore-error=true

- name: Validate dbt project (dbt parse)
# `dbt parse` exercises the dbt manifest: duplicate model/test
Expand Down Expand Up @@ -448,7 +448,7 @@ jobs:
# Scope cache per image name so unrelated connectors don't evict
# each other's layer cache.
cache-from: type=gha,scope=${{ matrix.entry.name }}
cache-to: type=gha,mode=max,scope=${{ matrix.entry.name }}
cache-to: type=gha,mode=max,scope=${{ matrix.entry.name }},ignore-error=true
# Keyless SLSA provenance — see backend-api-gateway for the contract.
- name: Attest build provenance
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
Expand Down Expand Up @@ -800,6 +800,16 @@ jobs:
fi
echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

# attest-build-provenance with push-to-registry reads DOCKER credentials
# (~/.docker/config.json) — `helm registry login` above writes to helm's
# own config, which the attest action cannot see. Without this login the
# attest step dies with "No credentials found for registry ghcr.io".
- uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

# Keyless SLSA provenance for the umbrella chart OCI artifact — same
# contract as the image attestations (see backend-api-gateway). Verify:
# gh attestation verify oci://ghcr.io/constructorfabric/charts/insight:<ver> \
Expand Down
4 changes: 3 additions & 1 deletion src/backend/services/analytics-api/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
# Rebuild marker (2026-06-11): republish so the chart-pinned tag advances to
# Rebuild marker (2026-06-11, take 2): republish so the chart-pinned tag advances to
# an SLSA-attested image — current appVersion predates the provenance
# attestation steps in build-images.yml.
# Take 2: the first publish-chart attempt failed before committing the
# appVersion bumps back to main (chart attest step lacked registry login).
# Multi-stage build for Insight Analytics API
#
# Build context: src/backend/
Expand Down
4 changes: 3 additions & 1 deletion src/backend/services/api-gateway/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
# Rebuild marker (2026-06-11): republish so the chart-pinned tag advances to
# Rebuild marker (2026-06-11, take 2): republish so the chart-pinned tag advances to
# an SLSA-attested image — current appVersion predates the provenance
# attestation steps in build-images.yml.
# Take 2: the first publish-chart attempt failed before committing the
# appVersion bumps back to main (chart attest step lacked registry login).
# Multi-stage build for Insight API Gateway
#
# Build context: src/backend/
Expand Down
4 changes: 3 additions & 1 deletion src/backend/services/identity/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
# Rebuild marker (2026-06-11): republish so the chart-pinned tag advances to
# Rebuild marker (2026-06-11, take 2): republish so the chart-pinned tag advances to
# an SLSA-attested image — current appVersion predates the provenance
# attestation steps in build-images.yml.
# Take 2: the first publish-chart attempt failed before committing the
# appVersion bumps back to main (chart attest step lacked registry login).
# Identity Resolution — .NET 9 service.
#
# Build context: src/backend/services/identity/
Expand Down
Loading